3cf399d3fbb87927fe7f8c5f41c3c652137361b8955493e30f04feaf2a49037d

Analysis

max time kernel
18s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:15

Target

3cf399d3fbb87927fe7f8c5f41c3c652137361b8955493e30f04feaf2a49037d.dll
Size

95KB
MD5

55431946e8aa6fa64c9afa12f550cea3
SHA1

8a16bcbf07eac49b5c5be2233c2b6fe6d6cd3415
SHA256

3cf399d3fbb87927fe7f8c5f41c3c652137361b8955493e30f04feaf2a49037d
SHA512

3e6c94ace9ce669cb12c80230067e86ec82f48798712e101a5b9d292a91016e4516c2ed661ea2cf6213e0d857f4e099dac089546591343a31e90e7990b34490a
SSDEEP

1536:a+NXXzUKhKXgdliY+V2tiasuxIv2saOELHbmtNwBVRJAII/cC8cQ72+5K:a9RXgdkY+V2sFuxo2sLE/vRyt67l5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1220	1184	rundll32.exe	28
PID 1184 wrote to memory of 1220	1184	rundll32.exe	28
PID 1184 wrote to memory of 1220	1184	rundll32.exe	28
PID 1184 wrote to memory of 1220	1184	rundll32.exe	28
PID 1184 wrote to memory of 1220	1184	rundll32.exe	28
PID 1184 wrote to memory of 1220	1184	rundll32.exe	28
PID 1184 wrote to memory of 1220	1184	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cf399d3fbb87927fe7f8c5f41c3c652137361b8955493e30f04feaf2a49037d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cf399d3fbb87927fe7f8c5f41c3c652137361b8955493e30f04feaf2a49037d.dll,#1
  2⤵
  PID:1220

memory/1220-55-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download